<!DOCTYPE html>
<html lang="en">
  <head>
    <link rel="stylesheet" type="text/css" href="/css/style.css?v=3" />
    <link rel="stylesheet" type="text/css" href="/css/fontello.css?v=2" />
    <link rel="stylesheet" type="text/css" href="/css/themes/nitter.css" />
    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" />
    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" />
    <link rel="manifest" href="/site.webmanifest" />
    <link rel="mask-icon" href="/safari-pinned-tab.svg" color="#ff6c60" />
    <link rel="search" type="application/opensearchdescription+xml" title="nitter" href="https://nitter.net/opensearch" />
    <title>Agentless Linux Security - Craig Rowland (@CraigHRowland): &quot;bioset:
&quot;md5&quot;: &quot;bf3a2ed557251175e994539f8cbcf150&quot;
&quot;sha1&quot;: fa45b3f8143a4ab044189ff01e105b2140d6fb53&quot;

kthreadd:
&quot;md5&quot;: &quot;7275d8b380e6facc7c5420603f2672cc&quot;
&quot;sha1&quot;:  &quot;a6ad6106aa4dacb6fc8262169779f743b9255bd&quot;&quot; | nitter</title>
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <meta property="og:type" content="article" />
    <meta property="og:title" content="Agentless Linux Security - Craig Rowland (@CraigHRowland)" />
    <meta property="og:description" content="bioset:
&quot;md5&quot;: &quot;bf3a2ed557251175e994539f8cbcf150&quot;
&quot;sha1&quot;: fa45b3f8143a4ab044189ff01e105b2140d6fb53&quot;

kthreadd:
&quot;md5&quot;: &quot;7275d8b380e6facc7c5420603f2672cc&quot;
&quot;sha1&quot;:  &quot;a6ad6106aa4dacb6fc8262169779f743b9255bd&quot;" />
    <meta property="og:site_name" content="Nitter" />
    <meta property="og:locale" content="en_US" />
    <link rel="preload" type="font/woff2" as="font" href="/fonts/fontello.woff2?21002321" crossorigin="anonymous" />
  </head>
  <body>
    <nav><div class="inner-nav">
        <div class="nav-item"><a class="site-name" href="/">nitter</a></div>
        <a href="/"><img class="site-logo" src="/logo.png" /></a>
        <div class="nav-item right">
          <div class="icon-container"><a class="icon-search" title="Search" href="/search"></a></div>
          <div class="icon-container"><a class="icon-bird" title="Open in Twitter" href="https://twitter.com/CraigHRowland/status/1422267857988063232"></a></div>
          <a href="https://liberapay.com/zedeus"><svg class="lp" viewBox="0 0 40.6 52.3">
  <g transform="matrix(0.83,0,0,0.83,-158,-261)">
    <path d="m202.5,366c-3.1 0-5.5-0.4-7.3-1.2-1.8-0.8-3-1.9-3.8-3.3-0.8-1.4-1.1-3-1.1-4.8 0-1.8 0.3-3.7 0.8-5.8l8.3-34.8 10.2-1.6-9.1 37.8c-0.2 0.8-0.3 1.5-0.3 2.2 0 0.7 0.1 1.2 0.4 1.7 0.3 0.5 0.7 0.9 1.3 1.2 0.6 0.3 1.5 0.5 2.7 0.6l-2 8.1"/>
    <path d="m239.2 344.3c0 3.2-0.5 6.1-1.6 8.8-1 2.6-2.5 4.9-4.4 6.9-1.9 1.9-4.1 3.4-6.7 4.5-2.6 1.1-5.4 1.6-8.5 1.6-1.5 0-3-0.1-4.5-0.4l-3 11.9h-9.7l10.9-45.4c1.7-0.5 3.7-1 6-1.4 2.3-0.4 4.7-0.6 7.3-0.6 2.4 0 4.6 0.4 6.3 1.1 1.8 0.7 3.2 1.8 4.4 3 1.1 1.3 2 2.8 2.5 4.5 0.5 1.7 0.8 3.6 0.8 5.5m-23.8 13.4c0.7 0.2 1.7 0.3 2.8 0.3 1.7 0 3.3-0.3 4.7-1 1.4-0.6 2.6-1.5 3.6-2.7 1-1.1 1.7-2.5 2.3-4.1 0.5-1.6 0.8-3.4 0.8-5.3 0-1.9-0.4-3.5-1.2-4.8-0.8-1.3-2.3-2-4.3-2-1.4 0-2.7 0.1-3.9 0.4l-4.6 19.1"/>
  </g>
</svg>
</a>
          <div class="icon-container"><a class="icon-info" title="About" href="/about"></a></div>
          <form class="icon-button" method="get" action="/settings">
            <input name="referer" value="/CraigHRowland/status/1422267857988063232#m" style="display: none; " />
            <button type="submit"><div class="icon-container"><span class="icon-cog" title="Preferences"></span></div></button>
          </form>
        </div>
      </div></nav>
    <div class="container"><div class="conversation">
        <div class="main-thread">
          <div class="before-tweet thread-line">
            <div class="timeline-item ">
              <a class="tweet-link" href="/CraigHRowland/status/1422127961625399296#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/CraigHRowland"><img class="avatar" src="/pic/profile_images%2F1050655612646830080%2Fal1tArWP_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/CraigHRowland" title="Agentless Linux Security - Craig Rowland">Agentless Linux Security - Craig Rowland</a>
                        <a class="username" href="/CraigHRowland" title="@CraigHRowland">@CraigHRowland</a>
                      </div>
                      <span class="tweet-date"><a href="/CraigHRowland/status/1422127961625399296#m" title="2/8/2021, 09:31:42">Aug 2</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">People are asking me to post hashes about this Linux malware we came across. No. Using hashes for finding Linux malware doesn't work and are easily altered. Look for tactics instead. Here are some tactics to use in this thread.</div>
                <div class="quote quote-big">
                  <a class="quote-link" href="/CraigHRowland/status/1422009387686645761#m"></a>
                  <div class="tweet-name-row">
                    <div class="fullname-and-username">
                      <img class="avatar mini" src="/pic/profile_images%2F1050655612646830080%2Fal1tArWP_mini.jpg" />
                      <a class="fullname" href="/CraigHRowland" title="Agentless Linux Security - Craig Rowland">Agentless Linux Security - Craig Rowland</a>
                      <a class="username" href="/CraigHRowland" title="@CraigHRowland">@CraigHRowland</a>
                    </div>
                    <span class="tweet-date"><a href="/CraigHRowland/status/1422009387686645761#m" title="2/8/2021, 01:40:32">Aug 2</a></span>
                  </div>
                  <div class="quote-text" dir="auto">More on this Linux stealth malware below.</div>
                  <a class="show-thread" href="/CraigHRowland/status/1422009387686645761#m">Show this thread</a>
                </div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 2</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 6</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 16</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item ">
              <a class="tweet-link" href="/marc_etienne_/status/1422251789525602317#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/marc_etienne_"><img class="avatar" src="/pic/profile_images%2F3248281367%2Fce5d079876ae38dbdb05945f915e0626_bigger.jpeg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/marc_etienne_" title="Marc-Etienne M.Léveillé">Marc-Etienne M.Léveillé</a>
                        <a class="username" href="/marc_etienne_" title="@marc_etienne_">@marc_etienne_</a>
                      </div>
                      <span class="tweet-date"><a href="/marc_etienne_/status/1422251789525602317#m" title="2/8/2021, 17:43:45">Aug 2</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">Most people asking for hashes aren't looking to input them as-is in some hypothetical "detection tool", but to reproduce you research, enrich analysis and perhaps make detections based on that.</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 3</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span> 0</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 14</div></span>
                </div>
              </div>
            </div>
          </div>
          <div id="m" class="main-tweet"><div class="timeline-item "><div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/CraigHRowland"><img class="avatar" src="/pic/profile_images%2F1050655612646830080%2Fal1tArWP_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/CraigHRowland" title="Agentless Linux Security - Craig Rowland">Agentless Linux Security - Craig Rowland</a>
                        <a class="username" href="/CraigHRowland" title="@CraigHRowland">@CraigHRowland</a>
                      </div>
                      <span class="tweet-date"><a href="/CraigHRowland/status/1422267857988063232#m" title="2/8/2021, 18:47:36">Aug 2</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/marc_etienne_">@marc_etienne_</a></div>
                <div class="tweet-content media-body" dir="auto">bioset:
"md5": "bf3a2ed557251175e994539f8cbcf150"
"sha1": fa45b3f8143a4ab044189ff01e105b2140d6fb53"

kthreadd:
"md5": "7275d8b380e6facc7c5420603f2672cc"
"sha1":  "a6ad6106aa4dacb6fc8262169779f743b9255bd"</div>
                <p class="tweet-published">6:47 PM · Aug 2, 2021</p>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 0</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 0</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 2</div></span>
                </div>
              </div></div></div>
        </div>
        <div class="top-ref"><div class="icon-container"><a class="icon-down" title="" href="#m"></a></div></div>
      </div></div>
  </body>
</html>